CVE-2026-7297: SourceCodester Pizzafy Ecommerce System ajax.php save_user cross site scripting
A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function saveuser of the file /admin/ajax.php?action=saveuser. Executing a manipulation of the argument Name can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7297?
CVE-2026-7297 is classified as a cross-site scripting (XSS) vulnerability that could lead to unauthorized access or manipulation of user data.
How do I fix CVE-2026-7297?
To fix CVE-2026-7297, ensure that proper input validation and output encoding are implemented in the save_user function in ajax.php.
Which versions of SourceCodester Pizzafy Ecommerce System are affected by CVE-2026-7297?
CVE-2026-7297 affects SourceCodester Pizzafy Ecommerce System version 1.0.
What type of attacks can be executed using CVE-2026-7297?
CVE-2026-7297 allows attackers to perform cross-site scripting attacks, potentially stealing cookies or session information.
Where is the vulnerable code located in the SourceCodester Pizzafy Ecommerce System for CVE-2026-7297?
The vulnerable code for CVE-2026-7297 is located in the save_user function within the /admin/ajax.php file.